3 ms·
Responsible disclosure doesn’t mean anything. It’s an obsolete term. You’re referring to coordinated disclosure. https://blogs.technet.microsoft.com/ecostrat/2
by lawnchair_larry 7y ago
Responsible disclosure doesn’t mean anything. It’s an obsolete term. You’re referring to coordinated disclosure.
https://blogs.technet.microsoft.com/ecostrat/2010/07/22/coordinated-vulnerability-disclosure-bringing-balance-to-the-force/ https://blogs.technet.microsoft.com/ecostrat/2010/07/22/coor...
- gok 7y agoThis case is actually a really great demonstration of why this often-repeated claim is false. This was responsible, but not coordinated, disclosure.
- lifthrasiir 7y agoOnly in the literal sense. A commonly cited issue on the term "responsible disclosure" is that the discoverer is responsible for one's action, even though the action indeed benefits the public. In this viewpoint the vender can argue that it is not responsible to ignore the vendor, even though the vendor itself is being unreasonable. The term "coordinated disclosure" is invented to fix this abuse. You can't literally interpret "responsible" or "coordinated" without this context.
- lawnchair_larry 7y agoThere’s nothing false about it. The term “Responsible Disclosure” was invented by a vendor as a self-serving PR tool to cover their own ass. “Responsible” is subjective and loaded, so it’s not useful terminology, and professionals in the field do not use it.